DNS Security: DNSSEC, DoH, and DoT

DNS is a critical but often overlooked attack surface.

DNS Threats

- DNS spoofing/cache poisoning
- DNS tunneling (data exfiltration)
- DNS hijacking
- Surveillance of queries

Security Technologies

- DNSSEC: Authenticates responses
- DoH: DNS over HTTPS
- DoT: DNS over TLS
- DNS filtering services

Implementation

- Enable DNSSEC validation
- Use encrypted DNS (1.1.1.1, 8.8.8.8)
- Deploy DNS filtering
- Monitor DNS logs
- Block DNS tunneling